Encryption declaration may contradict binary contents
Check PB-18 · App Store Review Guideline export compliance · Review warning · verified 2026-09-16
Why App Review rejects under Export compliance
Every build has to answer whether it uses non-exempt encryption. Standard HTTPS is exempt; a custom cipher is not. Leaving the key out of Info.plist stalls every submission with a question in App Store Connect; declaring false while the binary links CryptoKit or CommonCrypto for something beyond TLS can be questioned later. Set ITSAppUsesNonExemptEncryption explicitly and honestly.
How to fix it
If you only use standard HTTPS/TLS you can ignore this warning. If you implement a custom encryption algorithm, set the declaration to true and prepare export compliance documentation.
How RejectProof detects it
The scan reads your .ipa in the browser (or locally with npx rejectproof): Info.plist, entitlements, the privacy manifest, embedded frameworks and the executable itself. Check PB-18 reports the exact evidence it found — the key, the symbol, the file or the URL — so you can confirm it in your own project before changing anything. Nothing is uploaded; only a small redacted summary is sent to build the report, and you see it first.